CVE-2026-1963
📋 TL;DR
This CVE describes an improper access control vulnerability in WeKan's attachment storage component. Attackers can remotely exploit this to access or manipulate attachments they shouldn't have permission to view. All WeKan instances up to version 8.20 are affected.
💻 Affected Systems
- WeKan
📦 What is this software?
Wekan by Wekan Project
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized access to sensitive attachments containing confidential data, potentially leading to data breach or privilege escalation.
Likely Case
Unauthorized viewing or downloading of attachments from boards where the attacker lacks proper permissions.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure.
🎯 Exploit Status
The vulnerability allows remote exploitation and manipulation of attachments through improper access controls in the models/attachments.js file.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.21
Vendor Advisory: https://github.com/wekan/wekan/releases/tag/v8.21
Restart Required: Yes
Instructions:
1. Backup your WeKan data and configuration
2. Stop the WeKan service
3. Update to WeKan version 8.21 or later
4. Restart the WeKan service
5. Verify the update was successful
🔧 Temporary Workarounds
Disable Attachment Uploads
allTemporarily disable attachment functionality to prevent exploitation
Modify WeKan configuration to disable ATTACHMENTS_STORE_PATH or set ATTACHMENTS_ENABLED=false
Network Segmentation
allRestrict network access to WeKan instance
Configure firewall rules to limit access to trusted IPs only
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure to trusted users only
- Monitor attachment access logs for suspicious activity and implement alerting
🔍 How to Verify
Check if Vulnerable:
Check WeKan version via admin interface or by examining the running container/process. Versions 8.20 and below are vulnerable.Check Version:
Check WeKan admin dashboard or run: docker inspect wekan/wekan | grep WEKAN_VERSION or check package.json in installation directoryVerify Fix Applied:
Verify version is 8.21 or higher and check that commit c413a7e860bc4d93fe2adcf82516228570bf382d is present in the installation.📡 Detection & Monitoring
Log Indicators:
- Unusual attachment access patterns
- Access to attachments from unauthorized users or IPs
- Failed access attempts to restricted attachments
Network Indicators:
- Unusual traffic to attachment endpoints from unexpected sources
- Multiple rapid requests to /api/attachments/ endpoints
SIEM Query:
source="wekan" AND (uri_path="/api/attachments/*" OR event="attachment_access") AND (user NOT IN authorized_users OR src_ip NOT IN trusted_networks)